haiws[.]com

haiws.com was registered on March 11 2026 through West263 International Limited. The site presents a page titled “imtoken官方正版下载|imtoken钱包官网下载-imtoken安卓版/苹果版app下载|全球领先的数字货币钱包”, which mimics the branding of a well‑known cryptocurrency wallet to lure victims into downloading counterfeit applications. The domain is currently active and returns HTTP 200 responses. The domain resolves to the single IPv4 address 172.247.31.147, which is advertised as belonging to ASN 40065 (CNSERVERS LLC) and is geolocated in Hong Kong. Authoritative name servers are ns1.myhostadmin.net through ns4.myhostadmin.net, indicating use of a generic hosting control panel. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E7), which may increase user trust despite the malicious intent. Gridinsoft assigns a trust score of 0 out of 100, reflecting the extreme risk. Threat intelligence feeds corroborate the malicious nature of the domain. AlienVault OTX references the domain in 22 separate pulses, and VirusTotal records a single positive detection out of 95 scanned security vendors. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a generic phishing operation. The risk level is marked high, consistent with the observed infrastructure and lure tactics. Defenders should treat haiws.com as hostile infrastructure. Immediate actions include adding the domain and its resolving IP to network deny lists, updating endpoint and DNS filtering policies, and monitoring for any new resolution or certificate changes. Continuous telemetry collection is advised to detect potential repurposing of the hosting environment, and any observed credential or token theft should be investigated as part of an incident response workflow.